NetTraveler Is Back: The ‘Red Star’ APT Returns With New Tricks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2012-0158 | Remote Code Execution in Microsoft MSCOMCTL.OCX (Windows Common Controls) CVE-2012-0158 is a remote code execution flaw in Microsoft's MSCOMCTL.OCX, the Windows Common Controls ActiveX component, where improper handling of crafted input allows memory corruption and code execution. It is typically triggered when an application that uses the control (most commonly Microsoft Office) processes specially crafted content, such as a malicious document or file, meaning a victim usually has to open attacker-supplied content. Successful exploitation lets an attacker run arbitrary code and take complete control of the affected system with the privileges of the current user. Any Windows system carrying a vulnerable copy of MSCOMCTL.OCX — including systems where the control was redistributed by legacy applications — is affected, which makes the potential population very large. Exploitation is confirmed and ongoing: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and EPSS assigns it the maximum reported probability of exploitation within 30 days. Do: Apply the Microsoft security update for MSCOMCTL.OCX (per vendor instructions, per CISA's required action) on all systems, prioritizing endpoints and servers that open Office documents. Because exploitation commonly arrives via malicious documents, treat unsolicited Office/RTF attachments with suspicion and verify that applications that redistribute MSCOMCTL.OCX have installed a patched copy. Scan the estate for the presence and version of MSCOMCTL.OCX, especially on legacy Windows/Office installations that may be missed by routine patching. | — | 100% | KEV ransomware |
| masshundreds of millions of Windows systems potentially affected | |
| CVE-2013-2465 | Unspecified Flaw in Oracle Java SE 2D Component Exploited in the Wild (CVE-2013-2465) CVE-2013-2465 is an unspecified vulnerability in the Java Runtime Environment (JRE) component of Oracle Java SE, located in the 2D graphics/rendering subsystem. It is triggered via unknown vectors related to 2D, typically when a hostile applet or application causes the JRE to process crafted graphical content. An attacker who successfully exploits it can affect confidentiality, integrity, and availability, which in practice means remote compromise of the affected system without user credentials. Any deployment of Oracle Java SE — end-user desktops with the browser plugin and servers running JRE releases current at the time of the June 2013 Oracle Critical Patch Update — is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-28 with known ransomware use, EPSS assigns it a 98.7% probability of exploitation within 30 days (top percentile), and related 2013-era reporting around exploit kits such as LightsOut documents the era's heavy exploit-kit targeting of Java. Do: Apply the June 2013 Oracle Java SE Critical Patch Update, or any later supported Java SE release, per vendor instructions as CISA requires. Audit environments for legacy JRE installs and enabled Java browser plugin/applet support — especially on user-facing and internet-exposed legacy servers — and remove or upgrade them. Because CISA lists known ransomware use, prioritize patching external-facing and end-user systems. | — | 99% | KEV ransomware |
| masshundreds of millions of endpoints at the time of 2013 disclosure; today, a residual population of legacy Java deployments of unknown size |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | filetransfer.asp | nd control server, at “hxxp://worldmaprsh[dot]com/gzh/nettr/filetransfer[dot]asp”, hosted at IP 198.211.18.93. The IP is located in the |
| domain | weststock.org | l page link leads to a known NetTraveler-related domain at “weststock[dot]org”. Here’s the content of the page fetched from that URL: |
| domain | worldmaprsh.com | a previously unknown command and control server, at “hxxp://worldmaprsh[dot]com/gzh/nettr/filetransfer[dot]asp”, hosted at IP 198.211.1 |
| md5 | 15e8a1c4d5021e76f933cb1bc895b9c2 | n”. The payload of the exploit is a file named “file.tmp” ( 15e8a1c4d5021e76f933cb1bc895b9c2 ), which is stored inside the JAR. This is a classic NetTra |
| md5 | c263b4a505d8dd11ef9d392372767633 | simple HTML loads and runs a Java applet named “new.jar” ( c263b4a505d8dd11ef9d392372767633 ). The “new.jar” is an exploit for CVE-2013-2465, a very re |
| url | http://worldmaprsh[dot | cts to a previously unknown command and control server, at “hxxp://worldmaprsh[dot]com/gzh/nettr/filetransfer[dot]asp”, hosted at IP 198.211.1 |
Full article627 words · extracted from securelist.com · click to collapse
NetTraveler, which we described in depth in a previous post, is an APT that infected hundreds of high profile victims in more than 40 countries. Known targets of NetTraveler (also known as ‘Travnet’ or “Netfile”) include Tibetan/Uyghur activists, oil industry companies, scientific research centers and institutes, universities, private companies, governments and governmental institutions, embassies and military contractors.
During the last week, several spear-phishing e-mails were sent to multiple Uyghur activists. Here’s an example:
A rough translation:
“The spokesman of the WUC made the following statement about the massacre in Karghiliq country. To the kind attention of everyone.”
It contains a link to a page purportedly on the World Uyghur Congress website. However, the real page link leads to a known NetTraveler-related domain at “weststock[dot]org”.
Here’s the content of the page fetched from that URL:
This simple HTML loads and runs a Java applet named “new.jar” (c263b4a505d8dd11ef9d392372767633). The “new.jar” is an exploit for CVE-2013-2465, a very recent vulnerability in Java versions 5, 6 and 7, that was fixed by Oracle in June 2013. It’s detected and blocked by Kaspersky products generically as “HEUR:Exploit.Java.CVE-2013-2465.gen”.
The payload of the exploit is a file named “file.tmp” (15e8a1c4d5021e76f933cb1bc895b9c2), which is stored inside the JAR. This is a classic NetTraveler backdoor dropper (Kaspersky products block it as “Trojan-Dropper.Win32.Dorifel.adyb”), compiled on “Thu May 30 03:24:13 2013” if we are to believe the PE header timestamp.
This NetTraveler variant connects to a previously unknown command and control server, at “hxxp://worldmaprsh[dot]com/gzh/nettr/filetransfer[dot]asp”, hosted at IP 198.211.18.93. The IP is located in the U.S., at “Multacom Corporation” and used exclusively to host this C2:
The command and control server is active and operational at the time of writing of this blog, accepting stolen data from victims.
NetTraveler’s Watering Hole Attack
In addition to the spearphishing e-mails, watering hole attacks have become another popular method to attack unsuspecting victims by the APT operators.
There is perhaps no surprise that the NetTraveler attacks are now using this method as well. Last month, we intercepted and blocked a number of infection attempts from the known NetTraveler-related domain at “weststock[dot]org”. The redirections appeared to come from another Uyghur-related website belonging to the “Islamic Association of Eastern Turkistan”:
A quick look at the site’s HTML code reveals an iframe injection common to malicious websites:
The HTML page on “weststock[dot]org” referenced by the IFRAME contained another malicious applet, named “ie.jar”.
Conclusions
Immediately after the public exposure of the NetTraveler operations, the attackers shutdown all known C2s and moved them to new servers in China, Hong Kong and Taiwan. However, they also continued the attacks unhindered, just like the current case shows it.
The usage of the Java exploit for CVE-2013-2465 coupled with watering hole attacks is new, previously unseen development for the NetTraveler group. It obviously has a higher success rate than mailing CVE-2012-0158 exploit-ridden documents, which was the favorite attack vector until now. We estimate that more recent exploits will be integrated and used against the group’s targets.
Recommendations on how to stay safe from such attacks:
|
1 2 3 4 5 6 |
*Update Java tothe most recent version or,ifyou don't use Java, uninstall it. * Update Microsoft Windows and Microsoft Office to the latest versions. * Update all other third party software, such as Adobe Reader. * Use a secure browser such as Google Chrome, which has a faster development and patching cycle than Microsoft'sInternet Explorer. *Be wary of clicking on links andopening attachments from unknown persons. |
So far, we haven’t observed the use of zero-day vulnerabilities by the NetTraveler group; to defend against those, although patches don’t help, technologies such as AEP (Automatic Exploit Prevention)and DefaultDeny can be quite effective at fighting APTs.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/nettraveler-is-back-the-red-star-apt-returns-with-new-tricks/57455/